Question

我是Powershell的新手，并开始学习语法和所需的逻辑，但我已经做好了准备。

我需要在执行以下操作的条件字段中弹出

如果用户是“域管理员”组的成员，则显示“管理员”
如果用户是“ ReadOnlyAccess”组的成员，则显示“只读”

但是我的脚本不能完全做到这一点，我徘徊了如何更改脚本以获取所需的功能。

这是我的下面脚本：

Import-Module ActiveDirectory

$OUPath = "OU=1_Users,DC=DGDomain,DC=Local"

$filepath = "C:\temp\users.csv"

$readonlygroup = "ReadOnlyAccess"
$readonlygroupmembers = Get-ADGroupMember -Identity $readonlygroup | Get-ADUser -Properties SamAccountName | Select SamAccountName

$admingroup = "Domain Admins"
$admingroupmembers = Get-ADGroupMember -Identity $admingroup | Get-ADUser -Properties SamAccountName | Select SamAccountName

$users = Get-ADUser -Filter * -Properties * -SearchBase $OUPath |
         Where-Object { $_.Enabled -eq $true } |
         Select SamAccountName

Get-ADUser -Filter * -Properties * -SearchBase $OUPath |
Where-Object { $_.Enabled -eq $true } |
Select SamAccountName,
       DisplayName,
       @{Label = "Access Level"
            Expression =  {
                    foreach ($user in $users) {
                        if ($readonlygroupmembers -contains $users)
                            { "Read Only" }
                        else {
                            if ($admingroupmembers -contains $users)
                                { "Administrator" }
                            else
                                { "None" }
                            }
                        } } } |

Export-csv $filepath -NoTypeInformation

Answer 1

这应该可以解决问题：

$OUPath = "OU=1_Users,DC=DGDomain,DC=Local"

$filepath = "C:\temp\users.csv"

$readonlygroup = "ReadOnlyAccess"
$readonlygroupmembers = (Get-ADGroupMember -Identity $readonlygroup | Get-ADUser -Properties SamAccountName).SamAccountName

$admingroup = "Domain Admins"
$admingroupmembers = (Get-ADGroupMember -Identity $admingroup | Get-ADUser -Properties SamAccountName).SamAccountName

$users = Get-ADUser -Filter { Enabled -eq $true } -SearchBase $OUPath -Properties DisplayName

foreach ($user in $users) {
    if ($user.SamAccountName -in $admingroupmembers) { $groupMembership = 'DomainAdmin'}
    elseif ($user.SamAccountName -in $readonlygroupmembers) { $groupMembership = 'ReadOnly' }
    else {$groupMembership = 'None'}
    [PSCustomObject]@{
        DisplayName = $user.DisplayName
        SamAccountName = $user.SamAccountName
        AccessLevel = $groupMembership

    }
}

Export-csv $filepath -NoTypeInformation

如果用户属于该组，则显示此内容；如果不属于此组，则显示此内容

1 个答案: